Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as     an HMAC session cookie secret by default. These predictable default secrets can be exploited by an     attacker to forge session cookies. An attacker who knows or guesses the secret could compute valid HMAC     signatures for the session cookie, allowing them to tamper with or hijack another user's session.
    (CVE-2024-58134)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-985 advisory.

    Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's     class name, as a HMAC session secret by default.

    These predictable default secrets can be exploited to forge session cookies. An attacker who knows or     guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper     with or hijack another user's session. (CVE-2024-58134)

    Mojolicious versions from 7.28 through 9.39 for Perl may generate weak HMAC session secrets.

    When creating a default app with the mojo generate app tool, a weak secret is written to the     application's configuration file using the insecure rand() function, and used for authenticating and     protecting the integrity of the application's sessions. This may allow an attacker to brute force the     application's session keys.++6330 (CVE-2024-58135)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c38fd06bec advisory.

    Mojolicious versions from 0.999922 through 9.39 for Perl uses a hard coded string, or the application's     class name, as a HMAC session secret by default.

    Mojolicious  9.39 added EXPERIMENTAL support for encrypted session cookies. This feature is much more     secure than signed cookies and can be enabled by installing CryptX and setting the encrypted attribute.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
258717	Linux Distros Unpatched Vulnerability : CVE-2024-58134	Nessus	Misc.	high
237678	Amazon Linux 2023 : perl-Mojolicious, perl-Test-Mojo (ALAS2023-2025-985)	Nessus	Amazon Linux Local Security Checks	high
236992	Fedora 41 : perl-Mojolicious (2025-c38fd06bec)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2024-58134

high

Tenable Plugins

high

high

high